Hacker News new | past | comments | ask | show | jobs | submit
Claude code writes adds a `User-Agent` request header like `my-session-slug/1 <my.name@example.com>` when searching the web and requesting data. This violates the privacy of paying customers and has resulted in me getting dozens of scam and phishing emails per day from properties I have never personally visited. This policy is asinine: it does nothing but harm me, the customer, while providing immense value for scrapers and scammers.
Wow... this is insane! What a terrible idea.

These are the exact kinds of things that a human engineer would almost certainly never do.

This kind of thing is the problem of going all in on the idea of the AI Software Factory.

I don't know if this is an anti-abuse method they are using or some weird promotion for claude? It genuinely makes no sense from a user perspective.
I think you're overestimating the design intent that goes into a product that's proudly dogfooding the future of vibe coding.

It's very possible that nobody decided this at all and that's it just something an agent threw in on its own because some Chain of Thought imagined it was a clever way to correlate queries back with user accounts or something.

The reason they do this is because otherwise they block the requests.

I'm not sure what the issue is with publishing your email address in principle, you are reaching out, you want to inquire about some business. If anything use a different address. But why would you asymmetrically expect businesses with websites to bend over to give you all the advantages, they need some assurances as well.

Anonimity usually works one way, one party can be anonymous, not both, if you come from consumer land, it's the companies exposing themselves and doing all the compliance, if you choose privacy and force the companies to expose themselves, you'll get your wish granted, but there will be a cost, it's unlikely you'll be in the more advantageous position.

As implemented, it strongly violates the principle of least surprise (assuming this is true).

A more sane implementation of this would involve a prompt the first time an agent attempts to connect to each of the sites that Anthropic thinks it necessary to send this email header to, asking if this is OK (and bailing on all requests to that domain if the prompt was rejected).

loading story #50387208
loading story #50392454
Do you think this was a human choice, or one of those subtle Claude choices you don't notice until it bites you?

I'm sure the answer will be to update AGENTS.md to not do this particular thing, expose email in this way, which isn't the same as having sense.

I think none of these dolts have any idea what claude code does.